Backtrack Forensics: EXT3/4 file recovery with extundelete

extundelete is a file recovery tool for EXT3 / EXT4 journaling file system. It can recover files by reading the journal log, and the inode tables. The drive where we are recovering files from, should be unmounted in order to work. The restored files will be placed in the "RECOVERED_FILES" directory.

Usage:

It's quite simple. I created a new virtual hard disk for the test, formatted it, and placed 3 files there. I also created an MD5 sum for all.